Rails Ajax Authentication

Question

Hello,

Does anyone know if it is possible to create a secure authentication system using AJAX?

I would use the same recommended security techniques, except that the user name and password would be posted using AJAX.

If anyone has any ideas on why this would not be secure, or if they could point me to any resources that discuss this I would greatly appreciate it.

Thanks in advance.

Answer 1

Pretty sure you can't do this unless the page you are on is also ssl/https, as it will violate the Same Origin Policy (SOP) constraint on javascript.

You could encrypt in javascript before you send the request, but that's not terribly secure.

http://stackoverflow.com/questions/1790860/jquery-ajax-post-to-non-ssl-page-while-current-page-is-ssl